Redis配置ACL访问控制列表的实现

# redis.conf

# 默认用户配置，允许所有命令
user default on nopass ~* +@all

# 创建一个只读用户
user read_only_user on >readonlypassword ~* +@read

# 创建一个只写用户
user write_only_user on >writeonlypassword ~* +@write

# 创建或修改只读用户
ACL SETUSER read_only_user on >readonlypassword ~* +@read

# 创建或修改只写用户
ACL SETUSER write_only_user on >writeonlypassword ~* +@write

# 删除用户
ACL DELUSER write_only_user

# 列出所有用户
ACL LIST

# 获取指定用户的信息
ACL GETUSER read_only_user

import redis.clients.jedis.Jedis;

public class RedisACLExample {
    public static void main(String[] args) {
        try (Jedis jedis = new Jedis("localhost", 6379)) {
            // 认证为只读用户
            jedis.auth("read_only_user", "readonlypassword");

            // 尝试进行读取操作
            String response = jedis.ping();
            System.out.println(response);  // 应该输出 "PONG"

            // 尝试写入操作（将会失败）
            try {
                jedis.set("key", "value");
            } catch (Exception e) {
                System.out.println("Write operation failed: " + e.getMessage());
            }
        }
    }
}

import redis.clients.jedis.Jedis;

public class RedisDynamicACLExample {
    public static void main(String[] args) {
        try (Jedis jedis = new Jedis("localhost", 6379)) {
            // 创建或更新用户 read_only_user
            jedis.aclSetUser("read_only_user", "on", ">" + "readonlypassword", "~*", "+@read");

            // 认证为新用户
            jedis.auth("read_only_user", "readonlypassword");

            // 测试连接
            String response = jedis.ping();
            System.out.println(response);  // 应该输出 "PONG"
        }
    }
}

import redis.clients.jedis.Jedis;

public class RedisViewAndDeleteUserExample {
    public static void main(String[] args) {
        try (Jedis jedis = new Jedis("localhost", 6379)) {
            // 获取指定用户的信息
            String userInfo = jedis.aclGetUser("read_only_user");
            System.out.println(userInfo);

            // 删除用户
            jedis.aclDelUser("read_only_user");
        }
    }
}

# 允许用户只访问前缀为 "prefix:" 的键
ACL SETUSER user_with_key_access on >password ~prefix:* +@all

# 允许用户执行 GET 和 SET 命令
ACL SETUSER user_with_commands on >password ~* +@all -@write +get +set

# 禁止用户执行 FLUSHDB 和 FLUSHALL 命令
ACL SETUSER user_without_flush on >password ~* +@all -flushdb -flushall